Commit Graph

52 Commits

Author SHA1 Message Date
Christian Heimes af0a50de4b
bpo-47024: Update OpenSSL to 1.1.1n (GH-31895)
Co-authored-by: Zachary Ware <zachary.ware@gmail.com>
2022-03-15 21:03:04 +01:00
Kumar Aditya fc54e722a2
bpo-46106: Update OpenSSL to 1.1.1m (GH-30211)
Co-authored-by: Ned Deily <nad@python.org>
2021-12-21 21:20:16 -05:00
Christian Heimes 2985feac4e
bpo-46114: Fix OpenSSL version check for 3.0.1 (GH-30170) 2021-12-17 16:17:32 +01:00
Christian Heimes 512dbf6f56
Fix out-of-tree build support for multissltest (GH-29694) 2021-11-22 10:50:53 +01:00
Christian Heimes cc7c680194
bpo-38820: Test with OpenSSL 3.0.0 final (GH-28205)
Signed-off-by: Christian Heimes <christian@python.org>
2021-09-07 19:04:55 +02:00
Łukasz Langa d6cb5dd9e1
bpo-45007: Update multissl to openssl 1.1.1l as well (GH-28044)
This was missed while upgrading CI.
2021-08-30 05:24:51 -07:00
Christian Heimes 44fb551499
bpo-38820: Test with OpenSSL 3.0.0-beta1 (GH-26769)
Signed-off-by: Christian Heimes <christian@python.org>
2021-06-19 11:08:41 +02:00
Christian Heimes 7109624d45
bpo-38820: Test with OpenSSL 3.0.0-alpha17 (#26266) 2021-05-20 16:46:38 +02:00
Christian Heimes e8525567dd
bpo-38820: Test with OpenSSL 3.0.0-alpha16 (GH-25942)
Also use new make target to install FIPS provider.
2021-05-06 16:30:12 +02:00
Christian Heimes 3c586ca500
bpo-38820: Old OpenSSL 3.0.0 releases are in /old/3.0/ (GH-25624)
Signed-off-by: Christian Heimes <christian@python.org>
2021-04-26 10:54:12 +02:00
Christian Heimes dcf658157d
bpo-38820: Test with OpenSSL 3.0.0-alpha15 (GH-25537)
Signed-off-by: Christian Heimes <christian@python.org>
2021-04-23 14:19:21 +02:00
Christian Heimes 39258d3595
bpo-43669: PEP 644: Require OpenSSL 1.1.1 or newer (GH-23014)
- Remove HAVE_X509_VERIFY_PARAM_SET1_HOST check
- Update hashopenssl to require OpenSSL 1.1.1
- multissltests only OpenSSL > 1.1.0
- ALPN is always supported
- SNI is always supported
- Remove deprecated NPN code. Python wrappers are no-op.
- ECDH is always supported
- Remove OPENSSL_VERSION_1_1 macro
- Remove locking callbacks
- Drop PY_OPENSSL_1_1_API macro
- Drop HAVE_SSL_CTX_CLEAR_OPTIONS macro
- SSL_CTRL_GET_MAX_PROTO_VERSION is always defined now
- security level is always available now
- get_num_tickets is available with TLS 1.3
- X509_V_ERR MISMATCH is always available now
- Always set SSL_MODE_RELEASE_BUFFERS
- X509_V_FLAG_TRUSTED_FIRST is always available
- get_ciphers is always supported
- SSL_CTX_set_keylog_callback is always available
- Update Modules/Setup with static link example
- Mention PEP in whatsnew
- Drop 1.0.2 and 1.1.0 from GHA tests
2021-04-17 11:36:35 +02:00
Christian Heimes 150af75432
bpo-43788: Generate version specific _ssl_data.h (GH-25300)
Signed-off-by: Christian Heimes <christian@python.org>

Automerge-Triggered-By: GH:tiran
2021-04-09 08:02:00 -07:00
Christian Heimes a54fc683f2
bpo-43631: Update to OpenSSL 1.1.1k (GH-25024)
- [x] Build OpenSSL 1.1.1k for macOS
- [x] Build OpenSSL 1.1.1k for Windows

I have also updated multissl tester and various CI configurations to use latest OpenSSL. The versions were all over the place.

Signed-off-by: Christian Heimes <christian@python.org>

Automerge-Triggered-By: GH:tiran
2021-03-29 17:00:34 -07:00
Christian Heimes 32eba61ea4
bpo-43466: Add --with-openssl-rpath configure option (GH-24820) 2021-03-19 10:29:25 +01:00
Serhiy Storchaka 9355868458
bpo-41043: Escape literal part of the path for glob(). (GH-20994) 2020-06-20 11:10:31 +03:00
Christian Heimes a871f692b4
bpo-30008: Fix OpenSSL no-deprecated compilation (GH-20397)
Fix :mod:`ssl`` code to be compatible with OpenSSL 1.1.x builds that use
``no-deprecated`` and ``--api=1.1.0``.

Note: Tests assume full OpenSSL API and fail with limited API.

Signed-off-by: Christian Heimes <christian@python.org>
Co-authored-by: Mark Wright <gienah@gentoo.org>
2020-06-01 08:58:14 +02:00
Christian Heimes 6e8cda91d9
bpo-40457: Support OpenSSL without TLS 1.0/1.1 (GH-19862)
OpenSSL can be build without support for TLS 1.0 and 1.1. The ssl module
now correctly adheres to OPENSSL_NO_TLS1 and OPENSSL_NO_TLS1_1 flags.

Also update multissltest to test with latest OpenSSL and LibreSSL
releases.

Signed-off-by: Christian Heimes <christian@python.org>

Automerge-Triggered-By: @tiran
2020-05-15 18:33:05 -07:00
Christian Heimes 938717fd04
bpo-40163: Fix multissltest download of old OpenSSL (GH-19329) 2020-05-15 22:32:25 +02:00
Christian Heimes 62d618c06b
bpo-40479: Test with latest OpenSSL versions (GH-20108)
* 1.0.2u (EOL)
* 1.1.0l (EOL)
* 1.1.1g
* 3.0.0-alpha2 (disabled for now)

Build the FIPS provider and create a FIPS configuration file for OpenSSL
3.0.0.

Signed-off-by: Christian Heimes <christian@python.org>

Automerge-Triggered-By: @tiran
2020-05-15 09:48:25 -07:00
Benjamin Peterson 584a3cfda4
closes bpo-40266, closes bpo-39953: Use numeric lib code if compiling against old OpenSSL. (GH-19506) 2020-04-13 22:11:40 -05:00
Benjamin Peterson 909b87d2bb
closes bpo-39953: Generate ifdefs around library code definitions. (GH-19490) 2020-04-12 13:59:31 -05:00
Benjamin Peterson 3e0dd3730b
closes bpo-39953: Update OpenSSL error codes table. (GH-19082)
I updated the error codes using the OpenSSL 1.1.1f source tree.
2020-04-11 15:36:12 -05:00
Benjamin Peterson cd16661f90
closes bpo-40125: Update multissltests.py to use OpenSSL 1.1.1f. (GH-19248) 2020-03-31 10:49:56 -05:00
Christian Heimes 58ab13479d bpo-38117: Test with OpenSSL 1.1.1d (GH-15983)
Signed-off-by: Christian Heimes <christian@python.org>
2019-09-11 18:45:52 +02:00
Min ho Kim c4cacc8c5e Fix typos in comments, docs and test names (#15018)
* Fix typos in comments, docs and test names

* Update test_pyparse.py

account for change in string length

* Apply suggestion: splitable -> splittable

Co-Authored-By: Terry Jan Reedy <tjreedy@udel.edu>

* Apply suggestion: splitable -> splittable

Co-Authored-By: Terry Jan Reedy <tjreedy@udel.edu>

* Apply suggestion: Dealloccte -> Deallocate

Co-Authored-By: Terry Jan Reedy <tjreedy@udel.edu>

* Update posixmodule checksum.

* Reverse idlelib changes.
2019-07-30 18:16:13 -04:00
Christian Heimes e35d1ba9ea
bpo-34271: Fix compatibility with 1.0.2 (GH-13728)
Fix various compatibility issues with LibreSSL and OpenSSL 1.0.2
introduced by bpo-34271.

Signed-off-by: Christian Heimes <christian@python.org>
2019-06-03 20:40:15 +02:00
Christian Heimes 06651ee418
bpo-37081: Test with OpenSSL 1.1.1c (GH-13631)
Signed-off-by: Christian Heimes <christian@python.org>
2019-06-03 20:10:19 +02:00
Christian Heimes 9fb051f032 bpo-34670: Add TLS 1.3 post handshake auth (GH-9460)
Add SSLContext.post_handshake_auth and
SSLSocket.verify_client_post_handshake for TLS 1.3 post-handshake
authentication.

Signed-off-by: Christian Heimes <christian@python.org>q


https://bugs.python.org/issue34670
2018-09-22 23:32:31 -07:00
Christian Heimes 529525fb5a
bpo-33618: Enable TLS 1.3 in tests (GH-7079)
TLS 1.3 behaves slightly different than TLS 1.2. Session tickets and TLS
client cert auth are now handled after the initialy handshake. Tests now
either send/recv data to trigger session and client certs. Or tests
ignore ConnectionResetError / BrokenPipeError on the server side to
handle clients that force-close the socket fd.

To test TLS 1.3, OpenSSL 1.1.1-pre7-dev (git master + OpenSSL PR
https://github.com/openssl/openssl/pull/6340) is required.

Signed-off-by: Christian Heimes <christian@python.org>
2018-05-23 22:24:45 +02:00
Christian Heimes e8eb6cb792
bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 (GH-6976)
Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests and Travis config to test with latest OpenSSL.

Signed-off-by: Christian Heimes <christian@python.org>
2018-05-22 22:50:12 +02:00
Steve Dower e5f41d2f1e
bpo-33522: Enable CI builds on Visual Studio Team Services (#6865) 2018-05-16 17:50:29 -04:00
Christian Heimes 4ca0739c9d
bpo-33127: Compatibility patch for LibreSSL 2.7.0 (GH-6210)
LibreSSL 2.7 introduced OpenSSL 1.1.0 API. The ssl module now detects
LibreSSL 2.7 and only provides API shims for OpenSSL < 1.1.0 and
LibreSSL < 2.7.

Documentation updates and fixes for failing tests will be provided in
another patch set.

Signed-off-by: Christian Heimes <christian@python.org>
2018-03-24 15:41:37 +01:00
Christian Heimes 05d9fe32a1
bpo-32947: OpenSSL 1.1.1-pre1 / TLS 1.3 fixes (#5663)
* bpo-32947: OpenSSL 1.1.1-pre1 / TLS 1.3 fixes

Misc fixes and workarounds for compatibility with OpenSSL 1.1.1-pre1 and
TLS 1.3 support. With OpenSSL 1.1.1, Python negotiates TLS 1.3 by
default. Some test cases only apply to TLS 1.2. Other tests currently
fail because the threaded or async test servers stop after failure.

I'm going to address these issues when OpenSSL 1.1.1 reaches beta.

OpenSSL 1.1.1 has added a new option OP_ENABLE_MIDDLEBOX_COMPAT for TLS
1.3. The feature is enabled by default for maximum compatibility with
broken middle boxes. Users should be able to disable the hack and CPython's test suite needs
it to verify default options.

Signed-off-by: Christian Heimes <christian@python.org>
2018-02-27 08:55:39 +01:00
Christian Heimes ced9cb5303
bpo-32549: Compile OpenSSL 1.1.0 on Travis CI (#5180)
Use an improved version of multissl test helper to compile a local copy
of OpenSSL 1.1.0g.

Signed-off-by: Christian Heimes <christian@python.org>
2018-01-16 21:02:26 +01:00
Christian Heimes 0d2c645d41
Update multissltests: 1.0.2m, 1.1.0g (#4232) 2017-11-02 17:38:11 +01:00
Steve Dower b84bcc48ae bpo-31392: Update SSL build for 1.1.0 (#3448) 2017-09-09 06:13:06 -07:00
Christian Heimes d3b9f97e6d Update multissl test helper (#3349)
Signed-off-by: Christian Heimes <christian@python.org>
2017-09-06 18:59:22 -07:00
Vinay Sajip dd917f84e3 Closes #27904: Improved logging statements to defer formatting until needed. 2016-08-31 08:22:29 +01:00
Antoine Pitrou 3b225d8bfb Issue #23248: Update ssl error codes from latest OpenSSL git master. 2015-01-18 17:40:17 +01:00
Antoine Pitrou 173ad83b07 Issue #23248: Update ssl error codes from latest OpenSSL git master. 2015-01-18 17:39:32 +01:00
Steve Dower 65e4cb10d9 Issue #22919: Windows build updated to support VC 14.0 (Visual Studio 2015), which will be used for the official 3.5 release. 2014-11-22 12:54:57 -08:00
Serhiy Storchaka 8f8ec92de8 Issue #19936: Added executable bits or shebang lines to Python scripts which
requires them.  Disable executable bits and shebang lines in test and
benchmark files in order to prevent using a random system python, and in
source files of modules which don't provide command line interface.  Fixed
shebang lines in the unittestgui and checkpip scripts.
2014-01-16 17:33:23 +02:00
Serhiy Storchaka b992a0e102 Issue #19936: Added executable bits or shebang lines to Python scripts which
requires them.  Disable executable bits and shebang lines in test and
benchmark files in order to prevent using a random system python, and in
source files of modules which don't provide command line interface.  Fixed
shebang line to use python3 executable in the unittestgui script.
2014-01-16 17:15:49 +02:00
Christian Heimes cb3558dcc1 Issue #18215: Add script Tools/ssl/test_multiple_versions.py to compile and
run Python's unit tests with multiple versions of OpenSSL.
2013-12-16 14:35:39 +01:00
Antoine Pitrou ffd4d47d0b Add a docstring at the top of Tools/ssl/make_ssl_data.py 2012-06-22 22:07:01 +02:00
Antoine Pitrou f7338f65fb Add forgotten files for #14837. 2012-06-22 21:12:59 +02:00
Georg Brandl 5684a9ac30 Clean up tools: remove "world" and "framer", move single SSL script to scripts/. 2010-12-30 17:32:22 +00:00
Georg Brandl cbb9421347 Fix bytes/str issues in get-remote-certificate.py. 2010-10-28 08:38:30 +00:00
Benjamin Peterson 90f5ba538b convert shebang lines: python -> python3 2010-03-11 22:53:45 +00:00